What
Some settings name a helper command that Claude Code runs to fetch credentials or headers, such as otelHeadersHelper and proxyAuthHelper. Previously these were always taken as written from every settings file. Now, when the environment variable CLAUDE_CODE_REMOTE_TOOLS_PIN_STORED_LOGIN is set:
- Helper settings in ordinary, user-writable settings files are ignored.
- Helper settings in policy (admin-managed) settings are kept only when the file is owned by the machine's administrator.
Without that variable, nothing changes.
Why
When Claude Code is serving tools remotely with a pinned login, a settings file that a user can edit can no longer swap in a different credential helper.
Documented inclaude-docs/government/deploy-claude-code/configure
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up proxyAuthHelper, on All settings.
| Read from the highest-priority source only | Reads the key only from the highest-priority source that carries a policy key, so a lower source's value is ignored even when the highest source sets none | [`apiKeyHelper`](#apikeyhelper), [`…settings-reference see the edit
Confirmed since
Anthropic's documentation has since written up otelHeadersHelper, on Error reference.
| `otelHeadersHelper failed; telemetry is not being exported. See /status: ...` | [Configuration warnings](#otelheadershelper-failed) |errors see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up otelHeadersHelper, on Error reference.
The name it cites is new in this build
New in this build: CLAUDE_CODE_REMOTE_TOOLS_PIN_STORED_LOGIN